An app is a folder. Server code is one file.
Static files are served as they are. Add a _worker.js and it answers every other request, with the signed-in person in the headers and the app's storage on env.
Your agent already knows this. Brod tells it when it connects.